I need toadd a sparkline to the searchresult so that I can create a visualization of which index is reporting a spike in usage. My serach result is as follows:
earliest=-2d@d latest=-1d@d i...
...nconsistent between similar searches when only the timeframe is changed.) Sample search (from "Addsparklinestosearchresults"): index=_internal
| chart sparkline count by s...
...ata to the present searchresults, instead of placing the sparklines for those 3 counters beside the hosts, it creates another set of host fields and then places the saprklines.
| stats avg(ProcV) a...
I am using a sparkline to display a bar-graph in my searchresults, the values displayed are percentage values, however due to the default behaviour of sparklines in splunk, a constant value of 100 i...
Running a sample search suggested by " Addsparklinestosearchresults " in Splunk Documentation for the latest version (8.0.5 as of this writing): index=_internal | chart sparkline count b...
I'm trying to create a sparkline following the magnitude example from https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/Addsparklinestosearchresults
My search is:
index="stats" | s...
Hi, I have a main search that look like this index=main RESPONSE_CODE="0" earliest =-4mon@mon latest=mon@mon
|stats count AS Total_success BY MERCHANT_CODE This will produce a t...
...ranch, version, product etc that I want to filter on.
When I click on the branch from the events viewer and click addtosearch no results are found, even though they were there in the previous results...
Is it possible toadd the search ID for the currently running searchto the searchresults?
I have a report that populates a summary index and I have an alert running against the summary index w...
...3 sent How can I also print out the FROM which is only available in the sub search in the result set of the main search? I already tried to resolve this with union, join, append, a...